Suspicious Removal of SES Identity Has Been (via cloudtrail)

title: Suspicious Removal of SES Identity Has Been (via cloudtrail)
id: 7644c777-b060-5bf6-b906-098515fea96d
status: stable
description: This rule detects an instance of an SES identity being deleted via the "DeleteIdentity" event. This may be an indicator of an adversary removing the account that carried out anomalous or hostile activities
references:
    - https://attack.mitre.org/techniques/T1070/
    - https://unit42.paloaltonetworks.com/compromised-cloud-compute-credentials/
author: Huntrule Team
date: 2026-05-06
tags:
    - attack.stealth
    - attack.t1070
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: 'ses.amazonaws.com'
        eventName: 'DeleteIdentity'
    condition: selection
falsepositives:
    - Unknown
level: medium